I think the part about running it through automated tools is fine, so long as they can read and understand the code in highlighted areas. This provides a repeatable, standardized process which eliminates some of the chance for human error. It's especially helpful in helping to remember what vulnerabilities exist in version whatever of various libraries/servers/etc. That's all stuff you'd be looking up in a CVE list anyways. Of course you need knowledgeable people configuring the tools and building custom patterns to search for the PII or other company specific sensitive data (paterns and var names).

Even with this, they should be having a conversation with the dev team to understand the intricacies and to double check that the documentation matches the current system (can't tell you how often old docs are used and were missing something).